jschoubben
32a99144f6
mesh/delivery closed: a newer head of the same pull request
mesh/delivery-group group feat/l3-final checking: 3 of 5 member(s) ready
mesh/check failed (2): unit: mesh-provisioner-client/cmd/mesh-provisioner-client.TestNatsANodeComingBackFil…; and 1 more | 32a99144f65e on 798d73eb11e9
recordOf writes catalogue.ManifestReads in NodeRecord.ManifestReads, once per build, so the assigner moves a want only to an engine that reads its manifest. A row holds the engine's own manifest to the baseline's words, so its new build is never held for a word only it reads. Claude-Session: https://claude.ai/code/session_01JG73KG7AfSdh6FP8VrBqCn
76 lines
2.9 KiB
Go
76 lines
2.9 KiB
Go
package link
|
|
|
|
import (
|
|
"encoding/json"
|
|
"sort"
|
|
"sync"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/catalogue"
|
|
"git.novox.be/novox/mesh-sdk/go/delivery"
|
|
)
|
|
|
|
// The node's record (novox/hq ADR 0555 §3, issue 1126): what the machine observes of itself, written in its own have key
|
|
// `<node>.node` (delivery.HaveNode.Record) with its facts, so every node and the parts that compose read it from the bus
|
|
// and hear its change as the key's. Each value is the one the controller took from this node's enrolment and reports
|
|
// until now (its profile's present capabilities and networks, its outward links, its health statement's contract, and
|
|
// the public halves of the keys it enrolled with), read here from the same sources, never from the controller.
|
|
|
|
// RecordKeys are the public halves the node holds and the certificate the mesh issued for its internal name, as read
|
|
// from its state directory at the time of a pass: the certificate arrives after enrolment, a rekey changes the tunnel key.
|
|
type RecordKeys struct {
|
|
TunnelKey string
|
|
SealingKey string
|
|
ServingKey string
|
|
Certificate string
|
|
// Authority is the mesh's own certificate as this machine last applied it (public).
|
|
Authority string
|
|
// Trusts is what this machine trusts a mesh signature from now (delivery.Trusts, ADR 0550 §2).
|
|
Trusts []string
|
|
}
|
|
|
|
// manifestReads is what this engine reads of a manifest (novox/hq ADR 0614 §4): the reader capabilities of the mesh-sdk it
|
|
// is built with, stated in its record so the assigner moves a want only to an engine that reads its manifest. Computed
|
|
// once: it is the build's, and never changes while it runs.
|
|
var manifestReads = sync.OnceValue(catalogue.ManifestReads)
|
|
|
|
// recordOf is the node's record from one facts report and its keys; nil for a report that carries no profile (one that
|
|
// says nothing of the machine, such as a rekey), so the record last written stands.
|
|
func recordOf(node string, r Report, keys RecordKeys) *delivery.NodeRecord {
|
|
if r.Profile == nil {
|
|
return nil
|
|
}
|
|
var p struct {
|
|
Capabilities []struct {
|
|
Name string `json:"name"`
|
|
Present bool `json:"present"`
|
|
} `json:"capabilities"`
|
|
Machine *struct {
|
|
Networks []catalogue.AttachedNetwork `json:"networks"`
|
|
} `json:"machine"`
|
|
}
|
|
raw, err := json.Marshal(r.Profile)
|
|
if err != nil || json.Unmarshal(raw, &p) != nil {
|
|
return nil
|
|
}
|
|
rec := &delivery.NodeRecord{V: delivery.Version, Node: node, TunnelKey: keys.TunnelKey, SealingKey: keys.SealingKey,
|
|
ServingKey: keys.ServingKey, Certificate: keys.Certificate, Authority: keys.Authority, Trusts: keys.Trusts,
|
|
ManifestReads: manifestReads()}
|
|
for _, c := range p.Capabilities {
|
|
if c.Present && c.Name != "" {
|
|
rec.Capabilities = append(rec.Capabilities, c.Name)
|
|
}
|
|
}
|
|
sort.Strings(rec.Capabilities)
|
|
if p.Machine != nil {
|
|
rec.NetworksSaid = true
|
|
rec.Networks = p.Machine.Networks
|
|
}
|
|
if len(r.Outward) > 0 {
|
|
rec.OutwardLinks = append([]string(nil), r.Outward...)
|
|
}
|
|
if r.Health != nil {
|
|
rec.Contract = r.Health.Contract
|
|
}
|
|
return rec
|
|
}
|